CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49223

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49224

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-49222

In Vvveb versions before 1.0.8.4, the admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id without verifying that product_question.product_id belongs to the current vendor's admin_id. A low-privileged vendor can read, approve, edit, or delete questions unde...

CVE-2026-49222

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

CVE-2026-49222 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

CVE-2026-49221

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.p...

CVE-2026-74015

Unauthenticated SQL Injection in Readabler 2.0.18 versions...

CVE-2026-73392

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-73365

Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...

CVE-2026-73355

Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...

CVE-2026-73345

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...

CVE-2026-73339

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73187

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-32466

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

EUVD-2026-60819

Unauthenticated SQL Injection in Readabler 2.0.18 versions...

CVE-2026-74015 WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

Unauthenticated SQL Injection in Readabler 2.0.18 versions...

CVE-2026-74015 WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability

Unauthenticated SQL Injection in Readabler 2.0.18 versions...

CVE-2026-74015

The WordPress Readabler plugin (versions before 2.0.18) has an unauthenticated SQL injection flaw allowing remote attackers to execute arbitrary SQL queries and exfiltrate sensitive data. CVSS 9.3 (Critical). PatchStack reports it; upgrading to 2.0.18 resolves the issue. No exploit code provided ...